NVIDIA Display Driver EUVD-2026-90092

Exploitation requires prior local access with a low-privileged account (AV:L, PR:L) on a system running a vulnerable NVIDIA Linux GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branch), and the attacker must be able to reach the NGX updater code path that uses the outdated, type-confusion-susceptible embedded cryptographic library. No user interaction is needed (UI:N) and complexity is low (AC:L), but the vulnerability is NOT remotely reachable - the absence of network exposure is the primary limiting factor, making shared/multi-user hosts (VDI, HPC/Tesla compute clusters, workstations with untrusted local users) the realistic risk surface. Exact affected/fixed driver versions must be confirmed from NVIDIA's advisory.

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local (AV:L), low-complexity attack requiring only low privileges (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - the classic profile of a local privilege-escalation / code-execution flaw rather than a remotely reachable one. This is significant because it is NOT remotely exploitable: an attacker must already have a foothold with a local low-privileged account on the affected host, which sharply narrows real-world risk versus a network-facing bug of the same score. No EPSS score, CISA KEV listing, POC, or SSVC data was provided; per precision rules, this is 'no public exploit identified at time of analysis.' There is no signal of active exploitation. The root cause - an outdated embedded cryptographic library in the NGX updater vulnerable to type confusion (CWE-843) - makes reliable weaponization to full code execution non-trivial, and NVIDIA's language ('might lead to') is conditional. Net: a legitimately impactful local flaw worth patching on multi-user, shared, and hostile-local-user systems (VDI, HPC/Tesla compute nodes, workstations), but not an emergency for single-user or well-isolated endpoints. Note the CVE-org / product-security reference tree was not fully parsed here, so exact fixed driver-branch versions should be confirmed against NVIDIA's advisory (github.com/NVIDIA/product-security/tree/main/2026/5861).

A local user with a low-privileged account on a Linux system running a vulnerable NVIDIA GPU display driver crafts input that triggers the type-confusion flaw in the outdated crypto library used by the NGX updater. Successful exploitation corrupts memory to achieve code execution, information disclosure, or data tampering in the driver's context, potentially escalating privileges. No public exploit code is identified at time of analysis, and exploitation requires prior local access.